Get 'em while they're hot: critical security fixes from Microsoft, Apple Microsoft and Apple released a batch of critical security fixes within 24 hours of each other, patching a variety of components including the Internet Explorer browser, Bluetooth services and the QuickTime media player. Three Microsoft patches were rated critical, the highest threat ranking in Microsoft's four-tier scoring …
Interesting bug in Bluetooth. I wish MS had put A2DP in the stack for SP3. As far as I know it's not even available in Vista. Why fer? At least the Toshiba Bluetooth stack works well and includes about a half-million profiles.
Paris, just because.
"By default, Safari downloads files, without any user prompting, to the Windows desktop."
I don't believe anyone would classify that as a bug. It may not be the behaviour some users desire (in which case change it), but in itself it isn't a security risk.
"IE in some cases then executes those files."
WTF? Why would IE suddenly decide to execute a file downloaded by another piece of software. That *does* look like a bug MS need to fix - fast.
I turned my Vista SP1 machine on this morning... and guess what. Its bloody bricked it.
I get the logon screen, can login, then just get a black screen and a mouse pointer. Thats it. Nothing works apart from the on off switch. Even in safe mode (where I get the same result, just with a larger mouse pointer and 'Safe Mode' in the corners off my screen.
Its got to be due to these updates, as I only used Ebay last night... now my items are ending today and I don't have a machine to see what they are going for.
Cheers Microsoft.
So, Ben, you wouldn't consider it a bug in the system if you visited a website on FluffyKittens and Safari allowed the website to download a copy of the Al Queda handbook to your desktop without asking you if you wanted to download it?
Ignoring the autorunning executables side of things for a second, that's a pretty major problem, don't you think?
Same here and there is NO CURE for this. Believe me, I have scoured the internet for a sloution. No logon screen, no explorer, no task manager, just the black screen of frustration. You MAY get be able to get taskman up with Ctrl-Alt-Del then New Process but some people (me) can't. System restore, Vista startup repair doesn't even shift it. Laptop = total brick.
Safari doesn't just wily nilly download stuff. The USER has to click on a link, etc. to download something. The USER knows where they are browsing and what they click on to download.
The USER can also change this behavior, if they want to change the location of the download or be asked before a download, those are all options they can change within Safari preferences. They can also deny ALL downloads, cookies, etc.
The fact that IE or other windows programs will start a downloaded executable out of the blue, without asking it to, is definitely a problem, and M$ needs to fix this.
If a USER was navigating around nefarious sites and they the USER clicked on spoofed links that downloaded malicious executables, then this is a problem... however, EVEN IF Safari was set to ASK before downloading what the USER clicked on, the USER would mostly likely 100% of the time say YES, and click "don't ask me again"! If it really is a spoofed link, then the user won't know the difference anyhow, and accept when prompted. This would be the case UNIVERSALLY with ALL browsers.
So again, it is up to the USER to be smart, not to walk in bad neighborhoods. You walk in bad neighborhoods, you could get mugged, shot, or worse... just don't do it! It's the same with the web.
Now, if the USER simply got lost because of being naive, I agree, there should be more Cops around to direct the poor soul back to safety... however, it's again up to the individual to listen. In contrast, if those Cops consistently give bad advise, wrong directions, or over state a non-existent danger... it feels more like a limit to our freedom, then a protection.
On that topic, we also have to be careful, as the most dangerous alarm, is a false alarm. False alarms, condition people not to listen to alarms at all. Then when it's real, people die. It's the same in the web and browser world. Too many annoying false alarms, and people just turn them off, as they don't work. Additionally, alarms that don't work, give people false security. Therefore, if security is to be implemented, in needs to work 100% of the time with no false positives. Otherwise, it's better for the user to know that they need to be alert, and stay in the good neighborhoods and how to spot spoofed links and sites that could be dangerous.
CYA security is not real security, and does more harm then good IMO.
XP SP2. No need for 3. Tuesdays patches didn't break anything.
As for the Safari problem. Well, it's a mammoth java app, and badly written/designed.
As for why IE autoruns apps. Sure, it shouldn't. However, IE is >part< of the OS. Windows Explorer... essentially IE.
As for blaming the USERS, that won't fix anything. Not prompting is the problem and that's an Apple issue. The autoexecuting is an MS problem. People using Safari... well, that's just a problem.
OK, I was the first AC that said that Vista broke my machine. Well I am using it now, so all is not lost. However it was an annoying problem but here is a way to fix it (well this worked for me at least): Press F8 at boot and select Safe Mode (without networking) then system rollback to before the updates. This was the only way I could actually log into my profile. None of the other options worked. Saying that, the updates have blatently just downloaded again, so i'll probably be cursing again tomorrow!
Oh, I have an Acer Ferrari 4005Wlmi Laptop, which is running Vista x64 Business - a fresh install, not installed over the top of XP Pro.
Hope that helps anyone else feeling the Vista Blues.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
